S28 3556: Create GET /audit API endpoint

pre-api-stg.yaml

@@ -1255,6 +1255,52 @@ definitions:
           - ERROR
         type: string
     type: object
+  EntityModelAuditDTO:
+    properties:
+      _links:
+        $ref: '#/definitions/Links'
+      activity:
+        description: AuditActivity
+        type: string
+      audit_details:
+        $ref: '#/definitions/JsonNode'
+      category:
+        description: AuditCategory
+        type: string
+      created_at:
+        description: AuditCreatedAt
+        format: date-time
+        type: string
+      created_by:
+        $ref: '#/definitions/BaseUserDTO'
+      functional_area:
+        description: AuditFunctionalArea
+        type: string
+      id:
+        description: AuditId
+        format: uuid
+        type: string
+      source:
+        description: AuditLogSource
+        enum:
+          - APPLICATION
+          - PORTAL
+          - ADMIN
+          - AUTO
+        type: string
+      table_name:
+        description: AuditTableName
+        type: string
+      table_record_id:
+        description: AuditTableNameRecordId
+        format: uuid
+        type: string
+    required:
+      - created_at
+      - created_by
+      - id
+      - source
+    type: object
   EntityModelBookingDTO:
     properties:
       _links:
@@ -1950,6 +1996,20 @@ definitions:
         format: int64
         type: integer
     type: object
+  PagedModelEntityModelAuditDTO:
+    properties:
+      _embedded:
+        properties:
+          auditDTOList:
+            items:
+              $ref: '#/definitions/EntityModelAuditDTO'
+            type: array
+        type: object
+      _links:
+        $ref: '#/definitions/Links'
+      page:
+        $ref: '#/definitions/PageMetadata'
+    type: object
   PagedModelEntityModelBookingDTO:
     properties:
       _embedded:
@@ -2833,6 +2893,80 @@ paths:
       summary: Get the latest terms and conditions for the app
       tags:
         - terms-and-conditions-controller
+  /audit:
+    get:
+      operationId: getAuditLogs
+      parameters:
+        - description: The date time to search after
+          format: iso-date-time
+          in: query
+          name: after
+          type: string
+          x-example: '2021-01-01T00:00:00'
+        - description: The date time to search before
+          format: iso-date-time
+          in: query
+          name: before
+          type: string
+          x-example: '2021-01-01T00:00:00'
+        - description: The functional area to search by
+          in: query
+          name: functionalArea
+          type: string
+          x-example: API
+        - description: The source to search by
+          enum:
+            - APPLICATION
+            - PORTAL
+            - ADMIN
+            - AUTO
+          in: query
+          name: source
+          type: string
+        - description: Partial user's name to search by
+          in: query
+          name: userName
+          type: string
+        - description: The court id of the audit to search by
+          format: uuid
+          in: query
+          name: courtId
+          type: string
+          x-example: 123e4567-e89b-12d3-a456-426614174000
+        - description: The case reference of the audit to search by
+          in: query
+          name: caseReference
+          type: string
+          x-example: CASE12345
+        - description: The page number of search result to return
+          format: int32
+          in: query
+          name: page
+          type: integer
+          x-example: 0
+        - description: The number of search results to return per page
+          format: int32
+          in: query
+          name: size
+          type: integer
+          x-example: 10
+        - description: The User Id of the User making the request
+          format: uuid
+          in: header
+          name: X-User-Id
+          required: false
+          type: string
+          x-example: 123e4567-e89b-12d3-a456-426614174000
+      produces:
+        - application/octet-stream
+      responses:
+        '200':
+          description: OK
+          schema:
+            $ref: '#/definitions/PagedModelEntityModelAuditDTO'
+      summary: Search all Audits
+      tags:
+        - audit-controller
   '/audit/{id}':
     put:
       consumes:

src/functionalTest/java/uk/gov/hmcts/reform/preapi/controllers/AuditControllerFT.java

@@ -4,7 +4,11 @@
 import io.restassured.response.Response;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+import org.junit.jupiter.params.provider.NullSource;
 import uk.gov.hmcts.reform.preapi.controllers.params.TestingSupportRoles;
+import uk.gov.hmcts.reform.preapi.dto.AuditDTO;
 import uk.gov.hmcts.reform.preapi.dto.CreateAuditDTO;
 import uk.gov.hmcts.reform.preapi.enums.AuditLogSource;
 import uk.gov.hmcts.reform.preapi.util.FunctionalTestBase;
@@ -18,25 +22,89 @@ class AuditControllerFT extends FunctionalTestBase {
     @DisplayName("Should fail to update an audit record as they are immutable")
     @Test
     void updateAuditFailure() throws JsonProcessingException {
-        var audit = new CreateAuditDTO();
-        audit.setId(UUID.randomUUID());
-        audit.setAuditDetails(OBJECT_MAPPER.readTree("{\"test\": \"test\"}"));
-        audit.setSource(AuditLogSource.AUTO);
+        var audit = createCreateAuditDTO();
+        TestingSupportRoles authenticatedAs = TestingSupportRoles.SUPER_USER;
 
-        var success = putAudit(audit);
+        var success = putAudit(audit, authenticatedAs);
         assertResponseCode(success, 201);
 
-        var error = putAudit(audit);
+        var error = putAudit(audit, authenticatedAs);
         assertResponseCode(error, 400);
         assertThat(error.body().jsonPath().getString("message"))
             .isEqualTo("Data is immutable and cannot be changed. Id: " + audit.getId());
     }
 
-    private Response putAudit(CreateAuditDTO dto) throws JsonProcessingException {
+    private Response putAudit(CreateAuditDTO dto, TestingSupportRoles authenticatedAs) throws JsonProcessingException {
         return doPutRequest(
             AUDIT_ENDPOINT + dto.getId(),
             OBJECT_MAPPER.writeValueAsString(dto),
-            TestingSupportRoles.SUPER_USER
+            authenticatedAs
         );
     }
+
+    @DisplayName("Should sort by created at desc")
+    @Test
+    void getAuditLogsSortBy() throws JsonProcessingException {
+        var audit1 = createCreateAuditDTO();
+        TestingSupportRoles authenticatedAs = TestingSupportRoles.SUPER_USER;
+
+        var success1 = putAudit(audit1, authenticatedAs);
+        assertResponseCode(success1, 201);
+
+        var audit2 = createCreateAuditDTO();
+
+        var success2 = putAudit(audit2, authenticatedAs);
+        assertResponseCode(success2, 201);
+
+        var getAuditLogs1 = doGetRequest("/audit", TestingSupportRoles.SUPER_USER);
+
+        assertResponseCode(getAuditLogs1, 200);
+        var auditLogs1 = getAuditLogs1.jsonPath().getList("_embedded.auditDTOList", AuditDTO.class);
+
+        // default sort by createdAt desc
+        assertThat(auditLogs1.size()).isEqualTo(20);
+        // get index 1, as index 0 is the GET generated by the AuditListener audit method
+        assertThat(auditLogs1.get(1).getId()).isEqualTo(audit2.getId());
+        assertThat(auditLogs1.get(2).getCreatedAt()).isAfter(auditLogs1.getLast().getCreatedAt());
+    }
+
+    @ParameterizedTest
+    @NullSource
+    @EnumSource(value = TestingSupportRoles.class, names = "SUPER_USER", mode = EnumSource.Mode.EXCLUDE)
+    @DisplayName("Unauthorised use of endpoints should return 403 (or 401 for null authorisation)")
+    void unauthorisedRequestsReturn403Or401(TestingSupportRoles testingSupportRole) {
+        var getAuditLogsResponse = doGetRequest("/audit", testingSupportRole);
+        if (testingSupportRole != null) {
+            assertResponseCode(getAuditLogsResponse, 403);
+        } else {
+            assertResponseCode(getAuditLogsResponse, 401);
+        }
+    }
+
+    @DisplayName("Should put audit successfully as anonymous user")
+    @Test
+    void putAuditSuccessfullyAsAnonymousUser() throws JsonProcessingException {
+        CreateAuditDTO audit = createCreateAuditDTO();
+
+        Response response = putAudit(audit, null);
+        assertResponseCode(response, 201);
+    }
+
+    @DisplayName("Should put audit successfully as authenticated user")
+    @Test
+    void putAuditSuccessfullyAsAuthenticatedUser() throws JsonProcessingException {
+        CreateAuditDTO audit = createCreateAuditDTO();
+        TestingSupportRoles authenticatedAs = TestingSupportRoles.SUPER_USER;
+
+        Response response = putAudit(audit, authenticatedAs);
+        assertResponseCode(response, 201);
+    }
+
+    private CreateAuditDTO createCreateAuditDTO() throws JsonProcessingException {
+        var audit = new CreateAuditDTO();
+        audit.setId(UUID.randomUUID());
+        audit.setAuditDetails(OBJECT_MAPPER.readTree("{\"test\": \"test\"}"));
+        audit.setSource(AuditLogSource.AUTO);
+        return audit;
+    }
 }

src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java

@@ -32,7 +32,6 @@ public class SecurityConfig {
         "/prometheus",
         "/users/by-email/**",
         "/reports/**",
-        "/audit/**",
         "/b2c/**",
         "/error",
         "/app-terms-and-conditions/latest",
@@ -43,6 +42,10 @@ public class SecurityConfig {
         "/invites",
     };
 
+    public static final String[] PERMITTED_URIS_PUT_ONLY = {
+        "/audit/**",
+    };
+
     public static final String[] PERMITTED_URIS_POST = {
         "/invites/redeem",
         "/batch",
@@ -66,6 +69,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                                        authorize
                                            .requestMatchers(HttpMethod.GET, PERMITTED_URIS_GET_ONLY).permitAll()
                                            .requestMatchers(HttpMethod.POST,  PERMITTED_URIS_POST).permitAll()
+                                           .requestMatchers(HttpMethod.PUT, PERMITTED_URIS_PUT_ONLY).permitAll()
                                            .requestMatchers(PERMITTED_URIS_ALL_REQUESTS).permitAll()
                                            .anyRequest().authenticated()
             )